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(57) Abstract: The invention relates to a method and communication system allowing interception of a communication or con- 
nection of a target lo be intercepted. According to preferred embodiments of the invention, interception triggering information is 
transmitted between the user plane and control plane (e.g. via Gr-, Gc-, Gi-interfaces).The system comprises at least one control 
means for handling signalling of a connection between a user equipment and another communication device, and a support element 
for transmitting traffic information between the user equipment and the another communication device. When the connection is to 
be intercepted, the control means is adapted to generate an interception information for informing the support clement or another 
network clement on an identification of the target to be intercepted. The support clement is adapted to copy the traffic information 
lo another network element for interception when receiving an interception information from ihe control means. 
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METHOD AND SYSTEM ALLOWING LAWFUL INTERCEPTION OF CONNECTIONS 
SUCH AS VOICE-OVER-INTERNET-PROTOCOL CALLS 



DESCRIPTION 



FIELD AND BACKGROUND OF THE INVENTION 



The invention relates to a method and system enabling 
interception of traffic between network elements, in 
particular in a case where the traffic is transported based 
on protocols adapted for internet-involving connections such 
15 as IP (Internet Protocol) or other type of packet-based 
protocols . 



Fig. 12 shows a diagram of a system for lawful interception 
(LI) on the GPRS (General Packet Radio Service) plane. Apart 
20 from the elements 24, 25, 42, the network structure and 

network elements are in accordance with known standards or 
proposals . 

In this application LIGs contain Administration Function 
25 (ADMF) , Delivery Function 2 (DF2) and Delivery Function 3 

(DF3), or as in Fig. 7 DF3 is integrated to network elements. 

A network element 1, e.g. a terminal equipment TE and/or a 
mobile terminal MT of a subscriber, is connectable to the 

30 mobile network via a radio access network 2 which, according 
to Fig. 11, is implemented as a UMTS radio access network 
(UTRAN) but may also be a radio access network of other type. 
The system further comprises a home subscriber server (HSS) 
4, one or more serving support nodes (SGSN, Serving GPRS 

35 Support Node) 8, one or more gateway nodes (GGSN, Gateway 
GPRS Support Node) 11, one or more call state control 
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functions (CSCF) 16, one or more media gateway control 
functions (MGCF) 17, and cooperates with, or includes one or 
more network elements 18 for providing applications and 
services (APPSE) . The network element 18 includes one or more 
5 service control points (SCP) . 

The system further comprises SGWs 28 (Transport Signalling 
Gateway), MGWs (Media Gateways) 29, MRF (Multimedia Resource 
Function) 30 and provides connections to other networks such 
10 as PSTN (Public Switched Telephone Network), legacy/external 
network 41, a virtual private network (VPN 42), multimedia IP 
networks 43 and legacy signalling network 44, etc. 

As shown in Fig. 11, for performing lawful interception (LI), 
15 a Lawful Interception Gateway (LIG) 24 is provided which may 
be connected to or cooperate with a Law Enforcement Agency 
(LEA) 2 5 and may be connected to the support nodes 8 and/or 
11 for intercepting traffic between a network element to be 
intercepted (e.g. network element) and another called or 
20 calling terminal. The elements involved in lawful 

interception are marked by hatched lines. In Fig. 11, the 
dual line represents "control, call related information and 
call content". The broken line represents signalling 
connections. The continuous single line represents 
25 "signalling and data transfer". 

The system shown in Fig. 12 is able to intercept GPRS-based 
normal communications. However, a problem arises when 
interception is to be conducted with an internet-protocol- 
30 type connection such as a VoIP (Voice over IP) connection. 

GGSNs 11 normally do not recognise VoIP subscribers with IPT 
(IP telephony) identity. GPRS interception can therefore 
presently only be used for GPRS connections but not for VoIP 
connections . 

35 

In particular when the intended lawful interception (LI) does 
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not relate to the user identity on the transport level (i.e. 
the ID'S used by GPRS) but only to user identities used in 
the IM (Internet Multimedia) subsystem which are only known 
to the CSCF 16 (e.g. 
5 firstname.surname@sip.someoperator.com.), the support nodes 8 
and/or 11 do not have information for identifying the call 
and call contents to be intercepted. 

As an example, if the voice calls of a subscriber are to be 
10 intercepted, the GPRS support nodes may not be able to 

identify the calls by only relying on the PDP (Packet Data 
Protocol) contexts. 

15 SUMMARY OF THE INVENTION 

The invention provides a method and/or system with enhanced 
possibility of intercepting connections such as calls which 
are based on protocols adapted for internet or similar type. 

20 

The present invention provides a method and/or system as 
defined in the independent claims or any of the dependent 
claims. 

25 In accordance with a preferred embodiment of the invention, a 
control means such as CSCF is adapted to trigger an 
interception and has the necessary call-related information 
to identify the connections to be intercepted. The control 
element informs one or more of the support nodes such as SGSN 

30 or GGSN which PDP contexts should be intercepted. As an 

example, typically the call-related information should be 
reproduced or copied in a voice call interception will be 
interpreted in the control element while it is just another 
PDP context on the GPRS level. Therefore, an interaction 

35 between the control element and a support node is provides so 
that an interception can also be performed in a case where 
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the interception does not relate to the user identity on the 
transport level but only to the identity used on other levels 
such as in the IM subsystem. The control element thus is able 
to inform the support nodes such as GGSN to monitor VoIP 
5 subscriber's call contents. 

Otherwise stated, according to preferred embodiments, it is 
the application which runs on top of the services provided by 
the GPRS layer which will be intercepted and not every 
10 application used by the subscriber to be intercepted. 

According to some of the preferred embodiments interception 
triggering information is transmitted between the user plane 
and control plane (e.g. via Gr-, Gc-, Gi-interf aces) . 

15 

As a general concept, a control element such as CSCF or HSS 
informs one or more support network elements such as GGSN or 
SGSN to start sending user plane data to an intercept 
structure, e.g. a LIG. 

20 

The control means is able to inform a support node such as 
GGSN to monitor the subscriber's call content, e.g. of a VoIP 
call, in a standardised way. 

25 The proposed solution offers the control means such as CSCF a 
standardised possibility to intercept VoIP call content using 
the existing GPRS solution implemented in GGSN. Gi interface 
may be a standardised interface. 

30 The invention introduces several alternatives of call 

interception in an All-IP (Internet Protocol) environment. 

In one of the solutions, call content is intercepted from 
GGSN and call related information (reports) from CSCF and/or 
35 from application servers. The call control signaling may be 

put through SGSN and GGSN in one PDP context, and CSCF is the 
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first to recognize that the subscriber is to be monitored. 
CSCF is able to inform GGSN to copy the actual media, i.e. 
user traffic (both directions if needed) also to interception 
equipment, in addition to forwarding the actual media to the 
5 called terminal's address, in particular IP address. 

The invention may e.g. be used in an IP concept involving CPS 
and GGSN. 

10 The solution proposed according to the invention is 

advantageous over a theoretical alternative way of sending 
the triggering information via the LEA which would otherwise 
be required if the core network (SGSN and/or GGSN) and the 
control plane (CPS and HSS) are of different type, e.g. from 

15 different producers. The proposed solution is a faster way to 
trigger the interception. 

In accordance with an implementation of the invention, the LI 
in an All-IP Network (interception of VoIP 'calls' etc.) may 
20 be triggered in HSS and in CPS by setting appropriate 
triggers or trigger detection points in these elements. 

The interception is preferably triggered from the IPT 
Identity. The IPT Identity may e.g. be: IMSI, alias (e.g. 
25 user_id@domain_id) , E.164 number (MSISDN) , or IP address. 

When the user plane does not have knowledge about alias, it 
can at least provide triggering to other identities used in 
the user plane. 

30 

The IRIs (Intercept Related Information) from the control 
plane and CC (Content of Communication) from the user plane 
have to be bound together, i.e. correlated. In the 
embodiments shown in the drawings, Interception ID is 
35 preferably used as correlation ID. 
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Another possible correlation ID can be the call-related ID 
for charging purposes. This ID will be used in control and 
user plane. 

5 In further embodiments, the triggering information is assumed 
to be available in Gr and Gc interfaces, because HSS can get 
alias-related IMSI, MSISDN, PDP context, IP address and maybe 
IMEI. 

10 The triggering information is preferably provided also in Gi 
interface e.g. in case of terminated or forwarded party being 
a target for interception, when the SCP (Service Control 
Point) has only the subscriber's alias and MSISDN 
information. 

15 

If the charging ID cannot be used as a correlation 
information, the correlation ID should be delivered to the 
SGSN and GGSN with a LI trigger (in Gr, Gc and Gi 
interfaces) . 

20 

The delivery of the CC content to the LEA is preferably 
performed in accordance with standards and national laws 
(separation of directions, in speech or in data packets, 
etc. ) . 

25 

If the used codec information is not available in the SGSN or 
in the GGSN, CPS preferably delivers it to the LIG. 

If the context contains packets from several "calls", SGSN, 
30 GGSNor LIG preferably filters off packets not to be 
intercepted. 

Control and IRI interfaces between LIG - CPS and between LIG 
- HSS are preferably provided. 

35 
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BRIEF DESCRIPTION OF THE DRAWINGS ■ 

Fig. 1 illustrates a first embodiment of the invention, 

Fig. 2 illustrates a second embodiment of the present 
invention, 

Fig. 3 illustrates a third embodiment of the present 
invention, 

Fig. 4 illustrates a fourth embodiment of the present 
invention, 

Fig. 5 illustrates a fifth embodiment of the present 
invention, 

Fig. 6 illustrates a sixth embodiment of the present 
invention, 

Fig. 7 illustrates a seventh embodiment of the present 
invention, 

Fig. 8 illustrates an eighth embodiment of the present 
invention, 

Fig. 9 illustrates a ninth embodiment of the present 
invention, 

Fig. 10 illustrates a tenth embodiment of the present 
invention, 

Fig. 11 illustrates another embodiment of the present 
invention, and 

Fig. 12 illustrates a structure for lawful interception in a 
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pure GPRS-based system according to the prior art. 

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS OF THE 
5 INVENTION 

The drawings illustrate LI scenarios with GPRS access. In 
case of other access (e.g. WLAN) , the LI or at least copying 
the CC from the access is adapted accordingly. 

10 

In a preferred embodiment, for LI, in particular VoIP 
interception, the LI trigger is transmitted from HSS and CPS 
at least when the used identity is alias or other IPT 
identity which is not in user plane knowledge. 

15 

In Gi interface, the intercepted subscriber MSISDN or IP 
address is used to identify the intercepted context. 
Interception equipments (LEAs) IP address may also be used 
depending on the solution. CSCF may use the Gi interface to 
20 control VoIP interception in GGSN. 

This invention presents at least three different 
implementations how the interception is carried out after the 
information about the IP address is passed over the Gi 
25 interface. 

1) GGSN picks up an IP address of LEA (Law Enforcement 
Agency) from CSCF over the Gi interface and sends copies of 
all data packets also to that address. Signalling traffic is 

30 sent from CSCF to LIG (Lawful Interception Gateway) which then 
forwards them to LEA. 

2) GGSN picks up an IP address of IF over the Gi and copies 
all data packet there. LIG then forwards data packets via MGW 

35 (Media Gateway) to LEA. Signaling traffic is similar as in 
case 1. 

8 
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3) This is similar to case 2, but there the data traffic is 
sent directly from LIG to LEA, not via MGW. 

5 The problem may also be solved without CSCF and GGSN 

communicating. In this case, the CSCF may forward the IP 
address to LIG, which then handles the interception similar 
to known GPRS-based Interception. 

10 As a basic information to the embodiments shown in Figs. 1 to 
9, HSS has knowledge about subscriber's all IPT identities 
but CPS has only knowledge about subscriber's alias and 
MSI SDN. 

15 Fig. 1 shows a first embodiment of a method and system in 
accordance with the present invention. The same reference 
numerals as in Fig. 12 have been assigned to network elements 
similar to the network elements shown in Fig. 12 and 
described above. A mobile terminal 1 can get access and be 

20 attached to a network 3, preferably an IP network, via a 

radio access network RAN 2 which may correspond to UTRAN of 
Fig. 12 or be based on a GPRS standard, etc. The network 3 
comprises one or more serving support nodes 8 (SGSN = Serving 
GPRS Support Node) and one or mode gateway support nodes 11 

25 (GGSN = Gateway GPRS Support Node) . A home subscriber server 
HSS 4 includes a home location register (HLR) 5 and a user 
mobility server (UMS) 6. 

A call processing server (CPS) 15 of network 3 comprises a 
30 call state control function (CSCF) 16 and a media gateway 

control function (MGCF) 17 and is adapted to cooperate with 
the applications and services component (APPSE) 18. The 
network 3 communicates with other networks or components (not 
shown) via a gateway 26 using an internet protocol such as 
35 RTP (Real Time Protocol) . The gateway 26 includes a roaming 
signalling gateway function (R-SGW) 27, a transport 

9 
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signalling gateway function (T-SGW) 28, a media gateway (MGW) 
29, and a multimedia resource function (MRF) 30. Further, the 
structure shown in Fig. 1 includes a lawful interception 
gateway (LIG) 24 which is adapted to communicate with a law 
5 enforcement agency (LEA) 25. 

The structure shown in Fig. 1 allows a legal interception of 
IP-based connections between a user equipment such as mobile 
terminal 1 and another terminal equipment, e.g. of a called 
10 or a calling party. According to the structure of Fig. 1, 

standardised interfaces Gr, Gc, Gi may be used, in particular 
when all components necessary for interception are provided 
by the same supplier or producer. 

15 In the embodiment shown in Fig. 1, the double-dotted lines 7, 
11, 19 illustrate connections for providing and transmitting 
trigger information for triggering the interception in case 
of an IP telephony (IPT) or other type of connection to be 
intercepted. The trigger information will be sent to SGSN 8 

20 and/or. GGSN 11 when an interception is to be started. The 
trigger information will be sent from HSS 4 to SGSN 8 via 
interface Gr and link 7, and/or to GGSN 11 via interface Gc 
and link 10, and/or from CPS 15 to GGSN 11 via interface Gi 
and link 19. 

25 

The dot-and-dash lines 9, 14, 20 and 23 shown between HSS 4, 
SGSN 8, CPS 15 and GGSN 19, respectively, on the one hand, 
and LIG 24, on the other hand, illustrate the interception 
control, i.e. transmission of the control information, 

30 control commands and the like necessary for lawful 

interception control. The solid lines 12 and 22 shown between 
SGSN 8 and GGSN 11, on the one hand, and LIG 24 on the other 
hand represent CC (Content of Communication) which is sent to 
LIG 24 for interception. The arrow-headed lines 13, 21 

35 illustrate the flow of IRIs (intercept-related information) . 



10 



WO 02/093838 



PCT/EP01/05583 



In case the interception is handled by SGSN 8 alone without 
involving GGSN 11, the links / connections 22, 23 between 
GGSN 11 and LIG 24 can be omitted. Vice-versa in case the 
interception is handled by GGSN 11 alone, links and 
5 information flows 12 to 14 between SGSN 8 and LIG 24 can be 
omitted. For enhancing quality and success rate of 
interception, all links / information flows shown in Fig. 1 
may also be provided in parallel between SGSN 8 and GGSN 11 
on the one hand, and LIG 24, on the other hand. 

10 

In the embodiment shown in Fig. 1, the triggering information 
is available in Gr and Gc interfaces and is provided by HSS 4 
which gets alias-related IMSI, MSISDN, PDP context, IP 
address and/or possibly IMEI. 

15 

In Fig. 1, the triggering information may preferably also be 
provided in the Gi interface, in particular in a case when a 
terminated or forwarded party is the interception target. 

20 Stated more generally, in the solution according to Fig. 1, 
the control and user planes are composed of elements of the 
same producer, and all Gr, Gc and Gi interfaces are 
standardised interfaces. In more detail, HSS 4, CPS 15, SGSN 
8, GGSN 11 and LIG 24 are from the same producer and are in 

25 the same VPN (Virtual Private Network) . 

LIG 24 controls triggers (i.e. delivers IPT identities 
activation information) in the HSS 4 and in the CPS 15. HSS 4 
will trigger the interception from the IPT identity. HSS 4 

30 can set the LI trigger for all IPT identities but at least 

the alias triggering is needed. HSS 4 will map the triggered 
IPT ID to such a format (IMSI [default], MSISDN, IMEI or IP 
address) that LIG 24 or SGSN 8 or GGSN 11 will recognize it. 
HSS 4 will send the mapped LI trigger and correlation ID (if 

35 charging ID is not enough to bind IRIs and CC together) to 
the SGSN 8 and/or GGSN 11 directly (via Gr, Gc) . 
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If Gr, Gc and Gi interfaces are used, the trigger and 
ppssible correlation information is preferably standardised 
to those interfaces. If it is necessary to carry IPT identity 
5 (and PDP context ID) or the mapped LI trigger and correlation 
ID (if charging ID is not enough to bind IRIs and CC 
together) from HSS 4 to SGSN 8 and GGSN 11 via Gr and Gc and 
from CPS 15 to GGSN 11 via Gi for other reason than 
interception (e.g. charging or statistic) those interfaces 
10 can be standardised. With those Gr, Gc and Gi standards the 
IPT identity or mapped LI trigger can be used as a LI 
triggering key in SGSN and GGSN. 

SGSN 8 and/or GGSN 11 will send the CC (containing also 
15 correlation ID, charging ID or other correlation ID) to the 

LIG 24. SGSN 8 and CPS 15 wil send IRI information to the LIG 
24. 

Some IPT identities are in CPS knowledge (alias and MSISDN) 
20 so CPS 15 can trigger the LI and send the trigger key to the 
GGSN 11 e.g. in case a terminated or forwarded party is a 
target for interception. CPS 15 will send all communication 
related IRI information (containing also correlation 
information) to the LIG 24. IRI information can be sent to 
25 the LIG also from the HSS if it is needed. Such- a information 
can be e.g. location information if it is not known in SGSN 8 
or CPS 15. 

LIG 24 will create the reports for LEA and will separate user 
30 medias from the CC if it is requested by the authority or 
standards. 

Fig. 2 illustrates a further embodiment of the invention. In 
this and all further embodiments shown in Figs. 3 to 9 the 
35 same reference numerals are assigned to components having the 
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same or essentially the same structure or functioning as the 
components shown in Figs. 1 or 12. All above explanations 
regarding these components, their functioning and possible 
alternatives likewise apply to the components shown in Figs. 
5 2 to 9 (unless otherwise stated below) and are therefore not 
repeated again. 

The embodiment shown in Fig. 2 differs from the embodiment of 
Fig. 1 in that no standardised interfaces Gr, Gc, Gi between 
10 HSS 4 and SGSN 8, GGSN 11, and between CPS 15 and GGSN 11 are 
provided or used for interception. According to Fig. 2 the 
trigger information (information flow 10) is sent from HSS 4 
directly to LIG 24 instead to GGSN and SGSN 8 (as shown in 
Fig. 1) . 

15 

Likewise, the trigger information (information flow or link 
19) is directly sent from CPS 15 to LIG 24 (instead to GGSN 
11 as in Fig. 1) . The other information flows or connections 
9, 12 to 14, and 20 to 23 are similar to the embodiment of 
20 Fig. 1. That is, the interception control (dot-and-dash lines 
9, 14, 20, and 23), the IRI information flow (lines 13, 21), 
and the CC flow (lines 12, 22) are the same as in Fig. 1. 

In this embodiment, the LIG 24 informs the SGSN 8 and/or GGSN 
25 11 on the address or other identification of the party or 
equipment to be intercepted. 

In the embodiment of Fig 2, the control and user planes (HSS, 
CPS, SGSN, GGSN and LIG) are composed of elements of the same 
30 producer, and both Gr and Gc are non-standardised interfaces. 
HSS, CPS, SGSN, GGSN and LIG are in the same VPN. 

LIG 24 controls triggers in the HSS 4 and in the CPS 15 
(delivers IPT identities activation information to these 
35 elements) . HSS 4 will trigger the interception from the IPT 
identity. HSS can provide the trigger for all IPT identities 
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but at least the alias triggering is necessary. HSS 4 will 
map the triggered IPT ID to a format (IMSI [default], MSISDN, 
IMEI or IP address) that LIG or SGSN or GGSN can recognize. 
HSS will send the mapped LI trigger (e.g. IMSI) and 
5 correlation ID (if charging ID is not enough to bind IRIs and 
CC together) to the SGSN and/or GGSN via LIG. 

If Gr, Gc and Gi standards do not support IPT identity and/or 
mapped LI trigger and/or possible correlation ID, the LI 24 

10 is triggered via LIG 24, in particular in a case when 
standards are against delivering LI information in open 
interfaces (e.g. in USA) . In such a case HSS 4 and CPS 15 
will send the mapped LI trigger and correlation ID (if 
charging ID is not enough to bind IRIs and CC together) to 

15 the LIG 24. LIG 24 will send the LI trigger immediately to 
the SGSN 8 and/or GGSN 11. 

SGSN or/and GGSN will send the CC (containing also 
correlation ID, charging ID or other correlation ID) to the 
20 LIG. SGSN, CPS and possible HSS will send IRI information to 
the LIG. 

Some IPT identities are known to CPS 15 (alias and MSISDN) so 
it can trigger the LI and send the trigger key to the GGSN 

25 e.g. in case of terminated or forwarded party being a target 
for interception. CPS will send all communication related IRI 
information (containing also correlation information) to the 
LIG. IRI information can be sent to the LIG also from the HSS 
if it is needed. Such an information can be e.g. location 

30 information if it not known in SGSN 8 or CPS 15. 

LIG will create the reports for LEA and will separate user 
medias from the CC if it is requested by the authority or 
standards . 
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One of the advantages of Fig. 2 is the fact that no 
standardised interfaces or other communication between HSS 4, 
SGSN 8, GGSN 11, and CPS 15 are necessary for starting, 
controlling and performing interception. 

Fig. 3 shows a further embodiment in accordance with the 
present invention which includes, in addition to the 
components of the embodiment shown in Fig. 1, an additional 
lawful interception gateway (LIG) 31 which is adapted to 
communicate with LEA 25, similar to LIG 24. The embodiment 
according to Fig. 3 allows a VoIP LI with control of LI by 
LIG 24, and actual performing of the LI by LIG 31. According 
to the embodiment of Fig. 3, the identification information 
(IRI information) is sent to LIG 24 from HSS 4 (information 
flow or link 32), and from CPS 15 (information flow or link 
21). In addition, similar to the embodiment of Fig. 1, the LI 
control information (lines 9, 20) is sent from HSS 4 and CPS 
15 to LIG 24. The CC information is directly sent to LIG 31 
from SGSN 8 and/or GGSN 11 (lines 12, 22). According to Fig. 
3, the IRI information is directly sent from SGSN 8 to LIG 31 
to inform the latter on the address or other identification 
of the party or equipment to be intercepted. 

The embodiment of Fig. 3 is of advantage in that it enables a 
distinction between LI control and actual interception of 
communication content. The LIG 31 may be a gateway of any 
type which must simply be able to. communicate with SGSN 8 
and/or GGSN 11 but does not require to communicate, or be 
able to communicate, with HSS 4 and/or CPS 15. For instance, 
different LIG components 24, 31 produced by different 
producers may be used. As in Fig. 1, the structure of Fig. 3 
preferably provides standardised interfaces Gr, Gc, Gi for 
allowing a proper communication between HSS 4, SGSN 8, GGSN 
11 and CPS 15. 

In the scenario according to Fig. 3, IPT identity or LI 
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trigger (and PDP context ID) and possible correlation ID are 
carried from HSS to SGSN and GGSN via Gr and Gc interface, 
and from CPS to GGSN via Gi also in other cases than 
interception (e.g. charging or statistic) . The carrying 
5 manner may be standardised. IPT identity or LI trigger (e.g. 
IMSI) can be used as a LI triggering key in SGSN 8 and GGSN 
11. Note that the trigger in the Gi interface can be only the 
alias or MSISDN (only they are known to CPS 15) . 

10 HSS 4, CPS 15 and LIG 24 are preferably from the same 

producer or supplier, and. LIG 31 is from a different producer 
or supplier. HSS 4, CPS 15 and LIG 24 are in the same VPN. 

Here is assumed that Charging ID can be used as a correlation 
15 information with user' identity (e.g. IPT identity). Otherwise 
also correlation ID is preferably standardised to the Gr, Gc 
and Gi interfaces. 

LIG controls triggers in the HSS 4 and in the CPS 15 (deliver 
20 IPT identities activation information) . IRI information can 
be sent to the LIG also from the HSS if it is needed. Such a 
information can be e.g. location information if it is not in 
CPS's knowledge. 

25 HSS will trigger the interception from the IPT identity. HSS 
can make the LI trigger (e.g. IMSI) from all IPT identities 
but at least the trigger from alias (user@domain) is needed. 
HSS will send the LI trigger to the SGSN and GGSN directly 
(Gr, Gc) . CPS will trigger the interception e.g. in case of 

30 terminated or forwarded party being a target for interception 
and will send trigger key (alias or MSISDN) to the GGSN. 

One supplier may produce IRIs from the control plane (HSS and 
CPS) and the other supplier may produce LI trigger related 
35 (trigger in Gr and Gc) CC and possible IRIs to the LEA. 

16 
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The embodiment of Fig. 4 essentially represents a combination 
of the embodiments of Figs. 2 and 3 and does not require any 
standardised interfaces between HSS 4, SGSN 8, GGSN 11 and 
5 CPS 15. The additional LIG 31 and the LIG 24 operate in the 
same manner as shown and described with regard to Fig. 3 and 
receive the same information as in the embodiment of Fig. 3. 

In this embodiment of Fig. 4, Gr and Gc interfaces have non- 
10 standardised IPT ID or LI trigger correlation ID information. 

HSS 4, CPS 15 and LIG 24 are from one vendor and are in the 
same VPN. 

15 Here, the Charging ID or other standardised ID which is used 
in both control and user plane is used as a correlation ID 
with user identity (e.g. IPT identity or IMSI) . 

LIG 24 controls triggers in the HSS 4 and in the CPS 15 
20 (deliver IPT identities activation information) . IRI 

information can be sent to the LIG 24 also from the HSS 4 if 
it is needed. Such an information can be e.g. location 
information if unknown by CPS 15. 

25 HSS 4 and CPS 15 will trigger the interception from the IPT 
identity. HSS 4 and CPS 15 will send IRIs containing IPT 
identity or LI trigger and correlation ID (and PDP context) 
to the LIG 24. 

30 IRIs will be produced from the control plane (HSS and CPS) . 
The CC and possible IRIs will be produced and transmitted 
from SGSN and/or GGSN to the LEA, and will only be related to 
other IPT identities (IMSI, MSISDN and IP address) than 
alias . 

35 
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In Fig. 5, the gateways 24, 31 are exchanged as compared to 
the arrangement of Fig. 4. According to Fig. 5, an additional 
LI control flow or link 33 is provided between GGSN 11 and 
LIG 24. Moreover, standardised interfaces Gr, Gc, Gi are 
5 provided, similar to Fig. 1, between HSS 4, SGSN 8, GGSN 11 
and CPS 15. 

According to Fig. 5, IPT identity (and PDP context ID) and 
possible correlation ID are carried from HSS to SGSN and GGSN 
10 via Gr and Gc interfaces and from CPS to the GGSN via Gi 

interface for other reason than interception (e.g. charging 
or statistic) and in a standardized manner. IPT identity can 
be used as a LI triggering key in SGSN and GGSN. 

15 SGSN 8, GGSN 11 and LIG 24 are in the same VPN. 

Here, Charging ID is used as a correlation information with 
user identity (e.g. IPT identity) . Other correlation 
information is preferably standardised to the Gr and Gc 
20 interfaces. 

LIG 24 controls triggers (IPT identity) in the SGSN and in 
the GGSN. If Gr, Gc and Gi will support only the trigger 
mapped from the IPT identity e.g. IMSI, SGSN 8 and GGSN 11 
25 cannot start interception related to alias (user@domain) . 
Preferably, also SGSN 8 and GGSN 11 know IPT identities, 
because it is possible that neither the LEA 25 nor the LIG 24 
know the alias correspondence. 

30 HSS will trigger the interception from the IPT identity. HSS 
can make the LI trigger represented by any needed identity 
(IMSI, E.164, IP address, IMEI and IPT identity). In this 
scenario, the Gr and Gc interfaces are informed on the IPT 
identity itself. 

35 

IRIs and CC will be produced from the user plane (SGSN and 
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GGSN) and IRIs will be produced from the control plane. 

To ensure the reliability of the interception in a case where 
SGSN and GGSN cannot reliably start the interception related 
5 to IPT identity, IPT identity is set and known in HSS 4, CPS 
15, SGSN 8, GGSN 11 and LIG 24, 31, because the target can 
communicate with other user's UE (User Equipment) by using 
his own alias (user@domain) . 

10 Fig. 6 illustrates an embodiment having a similar structure 
as the embodiments of Figs. 4 and 5, but without the need of 
standardised interfaces Gr, Gc, Gi. An additional IRI 
information link 35 is provided between HSS 4 and LIG 31. 
Further, a control link 34 is present between SGSN 8 and LIG 

15 24. Such a link is already provided in the embodiment of Fig. 
5. 

The structure of Fig. 6 provides VoIP LI with a core network 
made of components of e.g. the same producer, as well as an 
20 additional LIG 31 which may be provided by another producer. 
Non-standardised interfaces may be provided without problems 
because of the shown information flows. 

According to this embodiment, Gr and Gc interfaces have non- 
25 standardised IPT ID (nor PDP context) information. 

SGSN 8, GGSN 11 and LIG 24 are in the same VPN. 

Here, the Charging ID is used as a correlation information 
30 with user identity (e.g. IPT identity, at least in control 
plane LI) . 

CC and IRIs will be produced from the user plane (SGSN and 
GGSN) and IRIs will be produced from the control plane. CC 
35 and IRIs can be produced from the SGSN and GGSN related to 
other IPT identity (IMSI, MSISDN and IP address) than alias. 
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Figs. 7 to 9 illustrate three further embodiments which are 
structurally based on the configuration of components shown 
in Fig. 12. Components shown in Fig. 12 and not represented 
in the embodiments of Figs. 7 to 9 (e.g. components 4, 18, 
43, 44) are preferably likewise provided in the embodiments 
according to Figs. 7 to 9 and are simply omitted for sake of 
clarity. In the structure shown in Fig. 12, only signalling 
information can be reported. Contrary thereto, in accordance 
with the embodiments shown in Figs. 7 to 9 three alternatives 
of VoIP interception are shown which use the Gi interface 
between CSCF 16 and GGSN 11 (and/or SGSN 8). 

In the embodiment shown in Fig. 7, the alias or MSISDN of the 
target to be intercepted is used to identify the context to 
be intercepted. The target alias or MSISDN is preferably sent 
from CSCF 16 to GGSN 11 via the Gi interface. It is also 
possible to deliver the IP address of the other party 
communicating with the party to be intercepted, and/or the IP 
address of LEA 24 from CSCF 16 to GGSN 11 via the Gi 
interface. This information flow is shown in Fig. 7 as well 
as in Figs. 8 and 9 by a dot-and-dash line referenced 51 in 
Fig. 7. Therefore, GGSN 11 can pick the alias or MSISDN of 
the interception target, and eventually also the IP address 
of the other party communicating with the target, and/or of 
LEA 24 from the Gi 'interface . The CSCF 16 further 
communicates, in all embodiments shown in Figs. 7 to 9, with 
a lawful interception gateway 50 via an information flow, 
link or channel 52 which transmits control and call related 
information. The LIG 50 may be provided in a virtual private 
network (VPN) 42 and may transmit and/or receive control and 
call-related information to and from LEA 24 via an 
information flow channel, link, etc. 55. These features 
likewise apply to the embodiments shown in Figs. 8 and 9. 

According to the embodiment of Fig. 7, the IP call content 
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represented by double-broken lines 53, 54, 56 is transmitted 
from GGSN 11 to LEA 24 via media gateway 29 and 
PSTN/legacy/external network 41. Both directions of 
information flow between the target and the other party may 
5 be separated and separately copied and transmitted to LEA 24. 

In Figs. 7 to 9, the signalling flow is represented by a 
single dot-and-dash line whereas signalling and data transfer 
is represented by single solid lines. 

10 

Fig. 8 illustrates a further embodiment having essentially 
the same structural arrangement as the embodiment of Fig. 7. 
In the embodiment of Fig. 8, the GGSN 11 is adapted to send 
the VoIP content directly to the LIG 50. The LIG 50 separates 
15 both directions from the VoIP media streams it receives from 
GGSN 11 and sends them separately to the media gateway 29 for 
further transmission to the other party communicating with 
the target to be intercepted and for copying it to LEA 24 
(via information flow link 56) . The information flow between 
. 20 GGSN 11, LIG 50 and MGW 29 is represented by double-broken 

lines 60, 61. Similar to the embodiment of Fig. 7, the target 
IP address is used to identify the intercepted context in the 
embodiment of Figs. 8 and 9. 

25 Fig. 9 illustrates a further embodiment having a structure 
similar to the structures of the embodiments of Figs. 7 and 
8. According to Fig. 9, the GGSN 11 is sending the VoIP 
content to the LIG 50 as represented by link or channel 60. 
The LIG 50 separates both directions from the VoIP media 

30 stream it receives from GGSN 11 and sends them separately to 
the LEA 24, as represented by information flow 70. The GGSN 
11 may send the VoIP content to the other party communicating 
with the target to be intercepted in the customary manner, 
e.g. via MGW 29. 

35 

According to the embodiments shown in Figs. 8 and 9, the GGSN 
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11 may receive the IP address of LIG 50 from the Gi interface 
to CSCF 16. 

Fig. 10 illustrates a further embodiment of the present 
5 invention. In this embodiment, only the LIG 24 of the Control 
plane vendor is needed. To ensure CC content delivery to the 
LIG IPT identity or LI trigger (and PDP context ID) , the 
delivery address (or addresses) of the LIG 24 and possible 
correlation ID are carried from HSS 4 to SGSN 8 and GGSN 11 
10 via Gr and Gc, and from CPS 15 to GGSN 11 via Gi interface. 
Note that the trigger in the Gi interface can be only the 
alias or MSISDN (only they are known to the CPS 15) . 

HSS 4, CPS 15 and LIG 24 preferably are from the same vendor 
15 so as to ensure good compatibility, and are in the same VPN. 

The Charging ID may be used as a correlation information with 
user identity (e.g. IPT identity) . Otherwise also correlation 
ID may be standardised to the Gr, Gc and Gi interfaces. Also 
20 delivery address (es) of the LIG 24 is preferably standardised 
to the interfaces. 

LIG 24 controls triggers in the HSS 4 and in the CPS 15 (i.e. 
delivers IPT identities activation information and LIG 1 s 
25 delivery addresses) . IRI information can be sent to the LIG 
24 also from the HSS 4 if it is needed. Such an information 
can be e.g. location information if it is not known in CPS 
15. 

30 HSS 4 will trigger the interception from the IPT identity. 
HSS 4 can generate the LI trigger (e.g. IMSI) from all IPT 
identities but at least the trigger from alias (user@domain) 
is needed. HSS 4 will send the LI trigger to the SGSN 8 and 
GGSN 11 directly (via Gr, Gc) . CPS 15 will trigger the 

35 interception e.g. in case of terminated or forwarded party 
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being a target for interception and will send trigger key 
(alias or MSISDN) to the GGSN 11. 

IRIs are produced from the control plane (HSS and CPS) . LI 
5 trigger related (trigger in Gr, Gc and Gi) GC will be 
delivered to the LIG 24. 

Fig. 11 shows another embodiment of the present invention. 

10 This embodiment illustrates some methods to ease the 

implementation and to provide more throughput to the Lawful 
Interception. 

A problem in VoIP is not only the data collection but also 
15 the interpretation of the collected data. When VoIP call goes 
through GPRS or any other data network it can be captured 
normally using IMSI, IMEI or MSISDN as target. This 
embodiment uses e.g. a standard data collection and 
introduces several different interpretation methods. 

20 

In VoIP lawful interception the voice is digital and 
transmitted in packets. Combining these packets stream to 
listenable audio stream needs special software and hardware. 

25 This problem might be solved by providing a new element that 
converts the intercepted voice packet streams to circuit 
switched (CS) data streams. These CS data streams could then 
be routed to LEA (lawful enforcement authorities) . 

30 In accordance with the present embodiment of the invention, 
the interpretation and storing of the VoIP interception 
product is transferred to LEAs. Advantages of the 
implementation in accordance with the present embodiment 
include the reduction of the amount of needed network 

35 elements. Further, the throughput of the delivery is better 
because there is no interpretation or format change for the 
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intercepted product. 

The decoding back to voice occurs at LEA site with the 

machines thereof and using their capacity. The load is this 

5 way also distributed to the users. 

The LEAs can play back and forth the intercepted content with 
an appropriate program such as Windows Multimedia Player just 
as easy as with a normal tape recorder. 

10 

The solution uses existing systems so that no new machines 
are needed. No switched circuit capacity problems occur at 
delivery interfaces. No unnecessary encoding/decoding takes 
place in the network. 

15 

In the following, some alternative solutions are presented: 

The data is collected and processed to known voice file 
formats (e.g. wav, mp3, au) at LIB (Lawful interception 

20 Browser, DF2 in ETSI terminology) or at LEAs machine. 
Normally the LEAs machine is a personal computer that 
contains www browser which has means of playing the standard 
audio files. The police authority (LEA) may then study this 
intercepted data just by playing the files and listening to 

25 the voice from computers speakers. 

As an alternative, the data is processed to real audio stream 
and delivered in realtime to the listening sites. The person 
or equipment at LEA may the connect to these stream and 
30 listen to the intercepted VoIP call. 

In an alternative solution, the data exists already in coded 
compact format which can be transformed to audible form by a 
special new plug-in module for the browsers. This alternative 
35 introduces a new audio data format for the browsers but uses 
as much as possible the already coded VoIP data. 
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The embodiment shown in Fig. 11 comprises a user equipment 4 0 
which may be similar to element 1 and conducts a call to be 
intercepted. The call is connected through a GSM or UMTS 
5 network 41 and further through a GPRS network 42 which may be 
an IP-based network. The signalling and user traffic of the 
call is handled by a SGSN 8 and an GGSN 11, similar to the 
above described embodiments. 

10 The network 42 includes a LIC (Lawful Interception 

Controller) 43 and a LIB (Lawful Interception Browser) 44. An 
authorised person or equipment such as a jugde instructs the 
LIC 43 to perform LI of calls/connections of the user of 
equipment 40. The LIC 43 sends instructions and information 

15 to the LIB 44 for intercepting the traffic, i.e. the call 

content of connections of the equipment 40. The LIB 4 4 sends 
the detected call content packets to the LEA 25 which 
interprets the packets for transforming them into audible 
form. 

20 

Whereas the embodiments of Figs. 1 to 10 are mainly directed 
to the manner of implementing the interception of VoIP on the 
system level, that means from where the intercepted content 
is collected, the embodiment of Fig. 11 is mainly directed to 

25 the processing of CC (CommunicationContent ) data by 

collecting or listening with browser. The voice information 
is not passed to the LEA in analog form. In practise the 
advantage of this invention is that a digital internet based 
application format may be used so that for LEA users it is 

30 easy to find programs. One of the advantages of this 

invention is that it makes coding/decoding easier, and 
actually transfers coding to LEA. 

The functioning and/or structure of the embodiment of Fig. 11 
35 as shown and described above, can be integrated into, or 
combined with, any of the embodiments of Figs. 1 to 10. 
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Although the invention has been described above with 
reference to specific embodiments, the invention intends to 
cover other embodiments as well which represent combinations 
5 of the above features, omissions, amendments, alternatives 
etc. 
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CLAIMS 



1. Communication system comprising at least one control 
means for handling signalling of a connection between a user 
equipment and another communication device, and a support 
element for transmitting traffic information between the user 
equipment and the another communication device, wherein, when 
the connection is to be intercepted, the control means is 
adapted to generate an interception f information for informing 
the support element or another network element on an 
identification of the connection to be intercepted, and the 
support element is adapted to copy the traffic information to 
another network element for interception. 

2. Communication system according to claim 1 wherein the 
control means is a CPS (Call Processing Server) or CSCF (Call 
State Control Function) . 

3. Communication system according to any one of the 
preceding claims, wherein the support element is a Serving 
Support Node and/or a Gateway Support Node. 

4. Communication system according to any one of the 
preceding claims, wherein the support element is a Serving 
GPRS Support Node (SGSN) and/or Gateway GPRS Support Node 
(GGSN) . 

5. Communication system according to any one of the 
preceding claims, comprising an interface between the support 
element and the control means for transmitting the 
interception information. 
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6. Communication system according to claim 5, wherein 
the interface is a Gi, Gc or Gr interface. 

7. Communication system according to any one of the 
5 preceding claims, wherein the interception information 

transmitted to the support element indicates an address, 
preferably an IP address, of the target (party or equipment) 
to be intercepted. 

10 8. Communication system according to any one of' the 

preceding claims, wherein the interception information 
transmitted to the support element indicates an address, 
preferably an IP address, of the other party connected to the 
target to be intercepted. 

15 

9. Communication system according to any one of the 
preceding claims, wherein the interception information 
transmitted to the support element indicates an address, 
preferably an IP address, of a Law Enforcement Agency (LEA) 
20 or Law Enforcement Monitoring Function (LEMF) , the Support 
element being adapted to send copies of data traffic to 
and/or from the target to be intercepted to the indicated 
address . 

25 10. Communication system according to claim 9, wherein 

the support element is adapted to send copies of the data 
traffic to a Media Gateway for forwarding the traffic to the 
Law Enforcement Agency (LEA) or Law Enforcement Monitoring 
Function (LEMF) . 

30 

11. Communication system according to any one of the 
preceding claims, wherein the interception information 
transmitted to the support element indicates an address, 
preferably an IP address, of a Lawful Interception Gateway 
35 (LIG) , the support element being adapted to send copies of 
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data traffic to and/or from the target to be intercepted to 
the indicated address. 

12. Communication system according to claim 11, wherein 
5 the Lawful Interception Gateway is adapted to directly send 

the copies of the data traffic to a Law Enforcement Agency 
(LEA) or Law Enforcement Monitoring Function (LEMF) . 

13. Communication system according to claim 11, wherein 
10 the Lawful Interception Gateway is adapted to send the copies 

of the data traffic to a Media Gateway for forwarding the 
traffic to a Law Enforcement Agency (LEA) or Law Enforcement 
Monitoring Function (LEMF) . 

15 14. Communication system according to claim 11, 12, or 

13, wherein the Lawful Interception Gateway is adapted to 
separate both directions of the media to and from the target 
to be intercepted and to forward them separately to a Media 
Gateway or Law Enforcement Agency (LEA) or Law Enforcement 

20 Monitoring Function (LEMF) . 

15. Communication system according to any one of the 
preceding claims, wherein the support node is adapted to 
separate both directions of the media to and from the target 

25 to be intercepted and to forward them separately to a Media 
Gateway or Law Enforcement Agency (LEA) or Law Enforcement 
Monitoring Function (LEMF) . 

16. Communication system according to any one of the 
30 preceding claims, wherein the control means is adapted to 

send signalling traffic, related to the connection to and/or 
from the target to be intercepted, to a Lawful Interception 
Gateway (LIG) . 

35 17. Communication system according to claim 16, wherein 

the Lawful Interception Gateway (LIG) is adapted to forward 
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the received signalling traffic to a Law Enforcement Agency 
(LEA) or Law Enforcement Monitoring Function (LEMF) . 

18. Communication system according to any one of the 

5 preceding claims, wherein the connection to be intercepted is 
a VoIP (Voice over IP) media connection. 

19. Communication system according to any one of the 
preceding claims, wherein an authorised interception agency, 

10 e.g. Law Enforcement Agency (LEA), is adapted for 

interpretation and storing of the intercepted traffic 
information content. 

20. Communication system according to any one of the 

15 preceding claims, wherein the data is collected and processed 
to a voice file format at a LIB (Lawful interception Browser, 
DF2 in ETSI terminology) or at a machine of LEA. 

21. Communication system according to any one of the 
20 preceding claims, wherein the data is processed to audio 

stream, e.g real audio, and delivered in realtime to a 
monitoring site. 

22. Communication system according to any one of the 
25 preceding claims, wherein the data exists in coded compact 

format and is transformed to audible form by a browser 
module. 

23. Method to be performed in a communication system 

30 comprising at least one control means for handling signalling 
of a connection between a user equipment and another 
communication device, and a support element for transmitting 
traffic information between the user equipment and the 
another communication device, wherein, when the connection is 

35 to be intercepted, the control means generates an 

interception information for informing the support element or 
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another network element on an identification of the 
connection to be intercepted, and the support element copies 
the traffic information to another network element for 
interception when receiving an interception information. 

24. Method according to claim 23, wherein the control 
means is a CPS (Call Processing Server) or CSCF (Call State 
Control Function) . 



10 25. Method according to claim 23 or 24, wherein the 

support element is a Serving Support Node and/or a Gateway 
Support Node . 

26. Method according to any one of the preceding method 
15 claims, wherein the support element is a Serving GPRS Support 
Node (SGSN) and/or Gateway GPRS Support Node (GGSN) . 



27. Method according to any one of the preceding method 
claims, comprising an interface between the support element 
20 and the control means for transmitting the interception 
information. 



28. Method according to claim 27, wherein the interface 
is a Gi, Gc or Gr interface. 

25 

29. Method according to any one of the preceding method 
claims, wherein the interception information transmitted to 
the support element indicates an address, preferably an IP 
address, of the target (party or equipment) to be 

30 intercepted. 



30. Method according to any one of the preceding method 
claims, wherein the interception information transmitted to 
the support element indicates an address, preferably an IP 
35 address, of the other party connected to the target to be 
intercepted. 
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31. Method according to any one of the preceding method 
claims, wherein the interception information transmitted to 
the support element indicates an address, preferably an IP 
5 address, of a Law Enforcement Agency (LEA) or Law Enforcement 
Monitoring Function (LEMF) , the support element being adapted 
to send copies of data traffic to and/or from the target to 
be intercepted to the indicated address. 

10 32. Method according to claim 31, wherein the support 

element sends copies of the data traffic to a Media Gateway 
for forwarding the traffic to the Law Enforcement Agency 
(LEA) or Law Enforcement Monitoring Function (LEMF) . 



15 33. Method according to any one of the preceding method 

claims, wherein the interception information transmitted to 
the support element indicates an address, preferably an IP 
address, of a Lawful Interception Gateway (LIG) , the support 
element being adapted to send copies of data traffic to 

.20 and/or from the target to be intercepted to the indicated 
address. 

34. Method according to claim 33, wherein the Lawful 
Interception Gateway is adapted to directly send the copies 

25 of the data traffic to a Law Enforcement Agency (LEA) or Law 
Enforcement Monitoring Function (LEMF) . 

35. Method according to claim 33, wherein the Lawful 
Interception Gateway is adapted to send the copies of the 

30 data traffic to a Media Gateway for forwarding the traffic to 
a Law Enforcement Agency (LEA) or Law Enforcement Monitoring 
Function (LEMF) . 

36. Method according to claim 33, 34, or 35, wherein the 
35 Lawful Interception Gateway is adapted to separate both 

directions of the media to and from the target to be 
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intercepted and to forward them separately to a Media Gateway 
or Law Enforcement Agency (LEA) or Law Enforcement Monitoring 
Function (LEMF) . 

37. Method according to any one of the preceding method 
claims, wherein the support node is adapted to separate both 
directions of the media to and from the target to be 
intercepted and to forward them separately to a Media Gateway 
or Law Enforcement Agency (LEA) or Law Enforcement Monitoring 
Function (LEMF) . 

38. Method according to any one of the preceding method 
claims, wherein the control means sends signalling traffic, 
related to the connection to and/or from the target to be 
intercepted, to a Lawful Interception Gateway (LIG) . 

39. Method according to claim 38, wherein the Lawful 
Interception Gateway (LIG) is adapted to forward the received 
signalling traffic to a Law Enforcement Agency (LEA) or Law 
Enforcement Monitoring Function (LEMF) . 

40. Method according to any one of the preceding method 
claims, wherein the connection to be intercepted is a VoIP 
(Voice over IP) media connection. 

41. Method according to any one of the preceding method 
claims, wherein an authorised interception agency, e.g. Law 
Enforcement Agency (LEA) , performs interpretation and storing 
of the intercepted traffic information content. 

42. Method according to any one of the preceding method 
claims, wherein the data is collected and processed to a 
voice file format at a LIB (Lawful interception Browser, DF2 
in ETSI terminology), or at a machine of LEA. 

43. Method according to any one- of the preceding method 
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claims, wherein the data is processed to audio stream, e.g. 
real audio, and delivered in realtime to a monitoring site. 

44. Method according to any one of the preceding method 
claims, wherein the data exists in coded compact format and 
is transformed to audible form by a browser module. 
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